Adobe Commerce contains an Incorrect Authorization (CWE-863) vulnerability (CVE-2026-47996) that enables a high-privileged attacker to read arbitrary files and directories beyond their intended permissions. The flaw allows unauthorized access to sensitive file system locations without requiring user interaction. The vulnerability changes the security scope, potentially exposing confidential data. No patch or official remediation guidance has been published yet, and no known exploits are reported in the wild.

A successful exploit could allow a high-privileged attacker to access sensitive files and directories outside their authorized scope, potentially leading to data exposure. The vulnerability does not impact integrity or availability but compromises confidentiality. Exploitation does not require user interaction, increasing the risk of automated or remote attacks by authorized users with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high-privileged user access and monitor for suspicious activity related to unauthorized file access attempts.